topic Re: Another LDAP Sync problem in Alfresco Archive

Another LDAP Sync problem

jsabah — Tue, 01 Sep 2009 06:08:11 GMT

Hi everyone,Very new to the world of Electronic Document Management, I am trying to get Alfresco CE 3.3 (nightly build) to work in my company. Not being a Network/System admin, I am currently struggling on 2 different points of the configuration of the application. In this topic, I will focus on the

Re: Another LDAP Sync problem

paulweb — Tue, 01 Sep 2009 06:48:22 GMT

Hi,
look this post http://forums.alfresco.com/en/viewtopic.php?f=9&t=20864
i upload last version svn head and compiled, with your chain work normal (os xp 32). http://svn.alfresco.com/repos/alfresco-open-mirror/alfresco/HEAD/
give you passthru-authentication-context.properties and ldap-ad-authentication.properties

Re: Another LDAP Sync problem

jsabah — Wed, 02 Sep 2009 05:14:14 GMT

Authentication is performed against AlfrescoNTLM and then Pagainst Active Directory (passthru).
LDAP-AD is used only for synchronization purpose.

My passthru-authentication-context.properties is:

passthru.authentication.useLocalServer=false
passthru.authentication.domain=MY_DOMAIN
passthru.authentication.servers=
passthru.authentication.guestAccess=false
passthru.authentication.defaultAdministratorUserNames=sabahj
#Timeout value when opening a session to an authentication server, in milliseconds
passthru.authentication.connectTimeout=5000
#Offline server check interval in seconds
passthru.authentication.offlineCheckInterval=300
passthru.authentication.protocolOrder=NetBIOS,TCPIP
passthru.authentication.authenticateCIFS=true
passthru.authentication.authenticateFTP=true‍‍‍‍‍‍‍‍‍‍‍‍

And ldap-ad-authentication.properties is:

ldap.authentication.active=false
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@domain

ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://my_domain:389
ldap.authentication.java.naming.security.authentication=simple

ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false

ldap.authentication.defaultAdministratorUserNames=Administrator

ldap.synchronization.active=true

ldap.synchronization.java.naming.security.principal=sabahj@domain
ldap.synchronization.java.naming.security.credentials=my_password

ldap.synchronization.queryBatchSize=1000

ldap.synchronization.groupQuery=(objectclass\=group)
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimestamp<\={0})))

ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))

ldap.synchronization.groupSearchBase=OU\=Users,OU=\ORGA,DC=DOMAIN,DC=local
ldap.synchronization.userSearchBase=OU\=Users,OU=\ORGA,DC=DOMAIN,DC=local

ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'

ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company

ldap.synchronization.defaultHomeFolderProvider=personalHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: Another LDAP Sync problem

paulweb — Wed, 02 Sep 2009 05:46:28 GMT

ldap.synchronization.groupSearchBase=OU\=Users,OU=\ORGA,DC=DOMAIN,DC=local
ldap.synchronization.userSearchBase=OU\=Users,OU=\ORGA,DC=DOMAIN,DC=local

maybe

ldap.synchronization.groupSearchBase=OU\=Users,OU\=ORGA,DC=DOMAIN,DC=local
ldap.synchronization.userSearchBase=OU\=Users,OU\=ORGA,DC=DOMAIN,DC=local

Re: Another LDAP Sync problem

oklein — Wed, 02 Sep 2009 05:49:06 GMT

ldap.authentication.userNameFormat=%s@domain

you have there instead of domain your real AD-Domain, have you?

Re: Another LDAP Sync problem

jsabah — Wed, 02 Sep 2009 05:59:12 GMT

you have there instead of domain your real AD-Domain, have you?

Do I need to put the real AD domain ? I thought it was just a format naming convention.

Re: Another LDAP Sync problem

paulweb — Wed, 02 Sep 2009 06:10:06 GMT

it is my work config for tests (full domain name my-domain.ru)


ldap.authentication.active=true
ldap.authentication.allowGuestLogin=true
ldap.authentication.userNameFormat=%s@my-domain.ru
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://pridc.my-domain.ru:3268
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=iam
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=iam@my-domain.ru
ldap.synchronization.java.naming.security.credentials=password
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.groupQuery=(objectclass\=group)
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimestamp<\={0})))
ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))
ldap.synchronization.groupSearchBase=ou\=XXXX XXXX XXXXXX,dc=my-domain,dc=ru
ldap.synchronization.userSearchBase=ou\=XXXX XXXX XXXXXX,dc=my-domain,dc=ru
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=personalHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: Another LDAP Sync problem

jsabah — Wed, 02 Sep 2009 06:58:13 GMT

I changed

ldap.authentication.userNameFormat=%s@MY_DOMAIN‍

and

ldap.synchronization.userSearchBase=OU\=Users,OU=\ORGA,DC=DOMAIN,DC=local
ldap.synchronization.userSearchBase=OU\=Users,OU\=ORGA,DC=DOMAIN,DC=local‍‍

I don't have any errors during Alfresco server startup, but I don't see any synchronization happening. I'd say it didn't really affect the sync behaviour.

Re: Another LDAP Sync problem

dward — Wed, 02 Sep 2009 10:30:35 GMT

On AD

ldap.authentication.userNameFormat

Should be a UPN. You can check what the correct format is using an LDAP browser. See

http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Configuration_2

Re: Another LDAP Sync problem

jsabah — Wed, 02 Sep 2009 23:06:28 GMT

On AD
ldap.authentication.userNameFormat
Should be a UPN. You can check what the correct format is using an LDAP browser. See
http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Configuration_2

OK, using Softerra LDAP Browser, I found that my UPN is "sabahj@MY.DOMAIN"

Now in order to have the synchronization working correctly (imported users are active by default with all their contact details) do I have to put:

ldap.authentication.userNameFormat=%s@MY.DOMAIN         #— which would give the correct format

OR

ldap.authentication.userNameFormat=sabahj@MY.DOMAIN         #— which is specific to my account‍‍‍‍‍

Re: Another LDAP Sync problem

paulweb — Wed, 02 Sep 2009 23:23:12 GMT

ldap.authentication.userNameFormat=%s@MY.DOMAIN
ldap.authentication.defaultAdministratorUserNames=sabahj

Re: Another LDAP Sync problem

jsabah — Wed, 02 Sep 2009 23:28:26 GMT

OK for the first item, I just enter the correct path with %s@MY.DOMAIN

ldap.authentication.defaultAdministratorUserNames=sabahj

Now I am confused. Isn't this item only used when ldap authentication is used to access the Alfresco platform ? Is it also needed to perform sync ?

Re: Another LDAP Sync problem

paulweb — Wed, 02 Sep 2009 23:43:12 GMT

in alfresco administrator: admin
If you (or other user) wish to be the admin of system Alfresco should specify that

ldap.authentication.defaultAdministratorUserNames=sabahj

Re: Another LDAP Sync problem

jsabah — Fri, 04 Sep 2009 01:48:15 GMT

Well, to make myself an admin, I used the following propertie passthru.authentication.defaultAdministratorUserNames=sabahj and it does work fine.

But back to the LDAP user details synchronization, it still doesn't work

Haven't tried touching the ldap properties, I don't want to break what is working so far

Re: Another LDAP Sync problem

paulweb — Fri, 04 Sep 2009 03:22:23 GMT

We in Russia have a saying:
"Wolves are afraid not to go to wood".

synchronization :


ldap.synchronization.active=true

ldap.synchronization.java.naming.security.principal=sabahj@MY.DOMAIN 
ldap.synchronization.java.naming.security.credentials=my_password

ldap.synchronization.queryBatchSize=1000

ldap.synchronization.groupQuery=(objectclass\=group)
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimestamp<\={0})))

ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))

ldap.synchronization.groupSearchBase=OU\=Users,OU\=ORGA,DC\=DOMAIN,DC\=local
ldap.synchronization.userSearchBase=OU\=Users,OU\=ORGA,DC\=DOMAIN,DC\=local

ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'

ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company

ldap.synchronization.defaultHomeFolderProvider=personalHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

ldap.synchronization.groupSearchBase=OU\=Users,OU\=ORGA,DC\=DOMAIN,DC\=local
ldap.synchronization.userSearchBase=OU\=Users,OU\=ORGA,DC\=DOMAIN,DC\=local

for example is my work searchBase (our AD all groups on the russian language therefor i am converting search base )


# The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.
ldap.synchronization.groupSearchBase=ou\=\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0441\u0442\u044b, ou\=\u0418\u0422 \u0434\u0435\u043f\u0430\u0440\u0442\u0430\u043c\u0435\u043d\u0442,ou\=\u042d\u043d\u043a\u043e\u0432\u0441\u043a, dc\=my-domain,dc\=ru

# The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.
ldap.synchronization.userSearchBase=ou\=\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0441\u0442\u044b, ou\=\u0418\u0422 \u0434\u0435\u043f\u0430\u0440\u0442\u0430\u043c\u0435\u043d\u0442,ou\=\u042d\u043d\u043a\u043e\u0432\u0441\u043a, dc\=my-domain,dc\=ru
‍‍‍‍‍‍‍

and in default-synchronization.properties


synchronization.synchronizeChangesOnly=true

# The cron expression defining when imports should take place
synchronization.import.cron=0 0 0 * * ?

# Should we trigger a differential sync when missing people log in?
synchronization.syncWhenMissingPeopleLogIn=true

# Should we auto create a missing person on log in?
synchronization.autoCreatePeopleOnLogin=true
‍‍‍‍‍‍‍‍‍‍‍‍

In dependence that you wish to receive from authentification in ALFRESCO, look following posts (if there will be that that not clearly I will try to explain)
http://forums.alfresco.com/en/viewtopic.php?f=9&t=21248
http://forums.alfresco.com/en/viewtopic.php?f=9&t=21339
http://forums.alfresco.com/en/viewtopic.php?f=9&t=21268
http://forums.alfresco.com/en/viewtopic.php?f=9&t=21482

Re: Another LDAP Sync problem

dward — Fri, 04 Sep 2009 10:55:16 GMT

I think PaulWeb may have led you a merry dance in his unique brand of English. So you actually have sync working but have found that user homes are appearing in the wrong place?

This was logged and fixed in

https://issues.alfresco.com/jira/browse/ETHREEOH-2535

Just set

ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider

Or build the latest code from HEAD.

You are using passthru for authentication and have rightly switched of LDAP authentication, so the LDAP authentication properties will not be relevant.

And your other problem is about enabling accounts in Share? This appears to be a bug in share. I have logged

https://issues.alfresco.com/jira/browse/ETHREEOH-2800

It looks to me that you're trying to edit ldap-ad-authentication.properties directly. This is not how to configure a subsystem as you will lose all your settings when you next upgrade. Your settings should be in alfresco-global.properties.

Re: Another LDAP Sync problem

paulweb — Fri, 04 Sep 2009 11:22:25 GMT

unique brand of English

Thanks for a compliment dward.
I apologise, for my cheerful English but if not to practise, it becomes better not precisely.

It I still while in section configuration, and here when will pass in section development…

Thanks you for the help and for understanding dward.

P.S: We are born, that a fairy tale to make a reality.

Re: Another LDAP Sync problem

dward — Fri, 04 Sep 2009 11:30:16 GMT

I apologise for my cheerful English but if I don't practise it will not get better

Sorry - I'll stop the language classes now.

Re: Another LDAP Sync problem

paulweb — Fri, 04 Sep 2009 11:35:59 GMT

Sorry - I'll stop the language classes now

I will try, but if stop, from it it becomes better not.

I feel to us long work on errors is necessary.

Re: Another LDAP Sync problem

paulweb — Fri, 04 Sep 2009 11:38:21 GMT

And here to you still bug dward
https://issues.alfresco.com/jira/browse/ALFCOM-3370
It is good, when I will come to work, I will place screen with an error. Synchronisation stops and gives out an error.